Privacy Policy

Last revised: October 2026

This is the Privacy Policy of IFG WebP Image Optimizer, a Shopify app by IFG eCommerce. The app is in development and has not been publicly released yet. This policy describes how the app works today and will be revised if that changes.

Who is responsible

Francesco Guiducci, owner of IFG eCommerce (Rome, Italy), contactable at info@ifgecommerce.com. He is the data controller for the data of your store's account with the app, listed below, and for the welcome email described below. For the content of your store that the app works on (images, product text), he acts as a processor on your behalf, as described in the Terms of Service.

What the app does

The app converts the images of your Shopify store to WebP. For each image it creates a new .webp file next to the original, moves the references it can reach onto the new file — product gallery, variant images, and image links written in the text of product descriptions, pages, blog articles and collection descriptions — and never deletes the original. Photos larger than 4472 pixels on a side or 20 megapixels are scaled down, keeping their proportions, to fit Shopify's limits; files above 20 MB, or larger than 80 megapixels (JPEG) or 40 megapixels (other formats), are not converted.

Data we process

Almost everything comes from your Shopify store, through Shopify's Admin API and webhooks. The app asks for these permissions only: reading and writing files (read_files, write_files), reading and writing products (read_products, write_products), reading and writing online store content (read_content, write_content, used to find and move image links in pages, blog articles and collection descriptions), and reading themes (read_themes, used only to find where an image is referenced; the app does not modify your theme).

• Store details: your myshopify.com domain, primary domain, time zone, the language you choose in the app, and installation status and dates.
• Access credentials: the Shopify access token (and refresh token) the app receives when you install it, with session details such as granted scopes and expiry. They are encrypted by the app (AES-256-GCM) before being stored, on top of the encryption at rest of the database.
• Image library data: for each image, its Shopify identifier, file name, URL, type, dimensions, size, alt text, status and dates, plus where it is used (for example the title of a product or the name of a theme file).
• Conversion records: the state of each conversion, the counters used to apply your plan's limits, and short-lived locks that prevent the same image from being converted twice at once. To make undo possible, for each product, page, blog article or collection the app changes it keeps an undo record: for a product, the order of its images and the position and variant assignments of the replaced image; for any text it changes (product description, page, blog article, collection description), the text exactly as it was before the change and as it was right after it. Undo uses that record to put back only the image links the app changed, leaving any other edit you made in the text as it is.
• Technical records: a receipt for each Shopify webhook (store, event identifier, topic, a fingerprint of the payload, outcome) and server logs. Logs are written so as not to contain access tokens or contact details.
• Welcome email data: described in the next section.

The image files themselves are not kept. To convert an image the app downloads it temporarily into the memory of the server, creates the WebP, uploads it to your Shopify store, and discards it. We do not store images or converted files on our systems, and we do not use a file storage service.

Welcome email

After a new installation we send one single welcome email to the email address of the store owner's Shopify account, which we read from Shopify's Admin API at install time (the public contact email of the store is never used). We also read the store name, to address you, and the country of the store's billing address, only to choose the language of the message. The email is sent by Francesco Guiducci (IFG eCommerce), thanks you for installing the app, introduces him as its freelance developer and invites you to reply with any question. It is a service message, not a newsletter or a promotion, and nothing else is sent afterwards. The email is not sent again if you uninstall and reinstall the app. It is delivered through Resend (United States), see below.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for the introduction, legitimate interest (Art. 6(1)(f) GDPR). You can object at any time by replying, using the unsubscribe link in the email, or writing to info@ifgecommerce.com.

What we store. The owner's email address is not stored in our records. While the app is installed we keep, for the store, a small record with its .myshopify.com domain, the sending status and its dates. If you unsubscribe, we also keep the date of the objection and a keyed cryptographic fingerprint (HMAC-SHA256) of the address. The fingerprint is pseudonymised, not anonymous: whoever holds the secret key could recompute it from a known address. It only serves to prevent sending again and to honour your objection (Art. 21 GDPR).

What remains after uninstall and erasure. After uninstall and the erasure request (shop/redact) we keep only a minimal record: the store's .myshopify.com domain, the sending status with dates and, for anyone who unsubscribed, the date of the objection and the keyed fingerprint of the address. This record, and the fingerprint, are deleted after 24 months.

What we do not collect

• No data about your customers. The app does not request read_customers or read_orders, so it never receives names, emails, phone numbers, addresses, orders or payment data of your shoppers.
• No tracking of your store's visitors: the app has no presence on your storefront (no scripts, app proxy or theme extension), and we use no analytics or advertising cookies.
• No artificial intelligence provider is involved: no data of your store is sent to a language model.
• The app sends no newsletters, promotions or marketing email. The only email it sends is the single welcome message described above, to the store owner.

Text you write in your store (file names, alt text, product descriptions, pages, blog articles, collection descriptions) is handled only as part of your catalogue, to find and replace image references. We do not analyse it for any other purpose.

Purposes and legal basis

• Performance of a contract (Art. 6(1)(b) GDPR): providing the features you installed the app for: scanning your image library, converting images, moving references, undoing a conversion and applying plan limits; and sending the welcome email to the store owner.
• Legitimate interest (Art. 6(1)(f) GDPR): keeping the app secure and working (logs, diagnostics, webhook receipts), keeping proof that privacy requests were handled, the personal introduction in the welcome email, and remembering an objection to it, always limited to what is strictly necessary.

We do not use this data for marketing, profiling or advertising, and we do not sell it.

Where data is stored and who is involved

• Google Cloud hosts the app (Cloud Run), the database (Firestore) and the secrets used by the app (Secret Manager), in the europe-west1 region (European Union). Google acts as a processor on our behalf.
• Shopify is the platform the app runs on and the source of your store's data. It processes your store's data under its own terms.
• Resend (United States) delivers the welcome email, and so receives the owner's email address, the store name and the content of the message at the moment of sending. Resend acts as a processor on our behalf and keeps its own delivery records under its terms. It is not used for any other purpose.

We do not share the data processed by this app with anyone else. The database is reached only by the app's own server code, with service credentials, and each store's data is kept separate and scoped to that store.

How long we keep data

• While the app is installed, we keep the data above to provide the service.
• On uninstall, the Shopify sessions (and so the access tokens) are deleted immediately. Shopify then sends us an erasure request, typically 48 hours after uninstall; when it arrives we permanently delete the store record, the image inventory and scan state, conversion records, plan counters, locks and the undo records. After that, undo is no longer possible.
• What remains after erasure: a register of the privacy requests we handled (store domain, type of request, outcome note and timestamps, with no personal data of any person), the webhook receipts described above, and the minimal welcome email record described above (store domain, sending status and dates, and for those who unsubscribed the date of the objection and the keyed fingerprint of the address), deleted after 24 months. They are kept as technical and compliance evidence, to avoid sending the welcome email again and to honour objections, and contain no images, product content or customer data.
• Server logs are kept in Google Cloud Logging for a limited time.

Uninstalling the app does not remove the WebP files it created in your store and does not move references back: the converted files stay in your store and the originals are untouched. If you want to undo conversions, do it from the app before uninstalling.

Shopify may send the app a request about a customer of your store (data request or erasure). The app holds no data about your customers, so there is nothing to export or erase; we answer accordingly and record the answer.

Your rights

Under Articles 15–22 GDPR you have the right to access the personal data we process about you, to have it corrected, to have it erased where no legal retention duty applies, to object to the processing or have it restricted, and to data portability. You can also lodge a complaint with a data protection authority (in Italy, the Garante per la protezione dei dati personali). To exercise your rights write to info@ifgecommerce.com.

Security

Shopify webhooks are verified by their HMAC signature before anything is stored. All communication with the app uses HTTPS/TLS. Access tokens are encrypted by the app and the database is encrypted at rest. Logs are filtered to drop credentials. No system is perfectly secure, and we cannot promise otherwise.

Changes to this policy

We may update this policy when the way we process data changes. The date at the top identifies the current text. We will revise it before the app is publicly released if anything described here has changed.

Contact

For any question about this policy: info@ifgecommerce.com.